PT-2024-31691 · Unknown · Symphony Xts Web Trading

Mohit Gadiya · Published 2024-09-03 · Updated 2024-09-07 · CVE-2024-45588

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Symphony XTS Web Trading version 2.0.0.1 P160

Description: This issue exists due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this by manipulating parameters through an HTTP request, leading to unauthorized access and modification of sensitive information belonging to other users.

Recommendations: For version 2.0.0.1 P160, consider restricting access to the Preference module until a patch is available. As a temporary workaround, avoid using the vulnerable API endpoints in the Preference module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-45588

Affected Products

Symphony Xts Web Trading

References · 8

• https://osv.dev/vulnerability/CVE-2024-45588 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45588 · Security Note
• https://twitter.com/cracbot/status/1832660200677110035 · Twitter Post
• https://t.me/cvenotify/93096 · Telegram Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 · Note
• https://t.me/latest_high_impact_cve/1096 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1830946843305406757 · Twitter Post
• https://twitter.com/CVEnew/status/1830917623967817983 · Twitter Post